Notes on Coronavirus and Business Continuity Planning

Tom Martin Ball, ISOQAR’s Information Security Sector Manager and Business Continuity expert, considers the role of business continuity planning and ISO 22301 in the face of the coronavirus crisis.

13 Mar 2020

When faced with a crisis, ‘Don’t Panic’ may seem like an inadequate response. But it’s an appropriate one. Not only does it emphasise a certain type of British sangfroid, it’s actually good advice.

This certainly applies when looking at Business Continuity and especially an organisation’s response to COVID-19 (coronavirus).

Careful planning and thinking things through will hopefully stop your organisation falling into a disaster. And here’s an important point; despite that fact that many people use the terms interchangeably, ‘business continuity’ is not ‘disaster recovery’.

With good planning, your organisation should never get as far as a disaster and therefore won’t have to recover from it; because if you do genuinely face a disaster, you may not recover.

It’s a sobering fact that more than 40% of businesses affected by the 1996 Manchester bombing went out of business, never to return.

I’m not giving a tutorial on how to implement ISO 22301 here, but I’m offering a few thoughts on its usefulness and the kind of things you should be thinking about regardless of whether you want a formal system in place.

Step 1 - Where are you?

Getting managers together for a 30-minute brainstorm and writing out a couple of sides of A4 can give the plan its focus and help identify clear priorities.

Amazing as it sounds, if you ask most organisations the so-called 5 W’s (who, what, why, when and how), they can’t answer you.

Who is important? Inside and outside your organisation.

What is important? Buildings, materials, records, laws and regulations.

Why is it important? Is it directly for products and services or part of support?

When is it important? Do you need it now or could you do without for a while?

How is it important? Are there alternatives?

Often the answers you’ll get are: “It’s obvious”. To which my response would be: “Then that should make it easy to define”. It rarely is.

If you’re looking for a shortcut through all this, I’d say the first thing to establish is this: What do you actually do?

Then you can work out who needs what you do, and when. Some things are critical, some not so much. How long can you and your customers go without?

Step 2 - Resource

This is the big one. The primary effect of any health concern is people, and they’re also your most important asset.

The government has estimated that one fifth of the workforce will be affected by coronavirus, 50% of them over a 3-week period, perhaps in April or May.

If COVID-19 is like seasonal flu (and I mean proper flu, not just a bad cold) victims will probably be totally out of action for up to 1 week.

On this basis, most organisations will be down by between 3% – 10% of their workforce. This doesn’t seem a lot, but that is only the direct effect.

22% of business continuity incidents are caused by childcare issues. Since many workplaces draw from small geographical areas, if a school shuts down, then significant numbers of staff could be affected.

Add to that caring for sick and elderly relatives, transport staff not at work so your employees can’t make it in, then the numbers could be much higher.

This is where homeworking (or ‘remote working’) comes into play. It’s something that many businesses are encouraging these days anyway, not only to save on the costs of office space, but to allow for more flexibility as employees seek the ideal work life balance. You need to ensure you have plans in place for this, too. Does the employee have a laptop and suitable broadband? Do you have enough VPN licences? What about data security? Do they have a company mobile phone? Is their kit insured when they take it home? Are you going to contribute to their heating bills? There are many questions to answer - but it’s all relatively straightforward. You just need to actually plan.

The virus is also likely to have a regional effect, as it has in China and Italy, so companies with multiple sites could be hit in some areas more than others.

But just because some staff are off doesn’t mean things can’t go on; perhaps those in less critical areas could cover. The Sales Manager could drive the delivery van, the HR officer work the phones. But this assumes they know how, are insured to drive and have the relevant passwords and system access. In other words, you need to have a plan in place for this.

Perhaps now, before the virus hits its peak, is a good time to check these things and do a bit of training? Identify the critical tasks and the less so. What is needed to do those job swaps?

It’s also time to think about the effects of staff taking leave. Could it be avoided? I know a company that has made arrangements for a creche at work. That’s maybe something you could think about.

Perhaps it’s also time to discuss if leave needs to be restricted. Not always popular, but staff may be more understanding at the moment. In terms of who is allowed time off and when, you probably currently operate a first come first served system. If this is going to cause problems, perhaps consider drawing lots, or involving staff themselves in devising a fair system.

Maybe some staff are happy to put in long hours and extra shifts. Is there a reward? Extra pay? Time off in lieu? Are managers given the budget to offer the informal rewards: cakes in the morning, pizza in the evening, a drink at the end of a long week?

Don’t forget though that staff do need to go home at some point! This is for legal reasons as well as tiredness. Knowing the law isn’t a good idea - it’s essential.

Step 3 - Secondary effects

If you’re affected, chances are your suppliers and customers are too. This could be good; a customer doesn’t need as much product. It could also be bad; lower sales means less cashflow.

Taking stock of what materials you need isn’t just a case of physical stock; it could be money. A discussion with the bank might be better done now, rather than later.

On the physical stock side, panic buying will probably make situations worse and you could end up with an excess of perishable and expensive items in your storeroom.

Open and honest discussions with suppliers might be a better option. The same when it comes to customers, too. (How much do you really need? Could we deliver half and send the rest once we are back up to numbers?)

Step 4 - Keep on top of things

Now is the time to keep your eye on the ball. Knowing what’s important means you can more carefully monitor the situation. It also allows you to sound the all clear and return to normal.

With that all said, I can only sign off with another great piece of British advice: ‘Keep calm and carry on’.